Feds Suspect Ransom Negotiator Helped Run ShinyHunters Leak Site
October 21, 2026
US investigators reportedly suspect executives at two ransomware negotiation firms had close ties to ShinyHunters, and one helped run its
Threat Actors
Feds Suspect Ransom Negotiator Helped Run ShinyHunters Leak Site
US investigators reportedly suspect executives at two ransomware negotiation firms had close ties to ShinyHunters, and one helped run its extortion site.
CISA, FBI Say SafePay Ransomware Has Hit 600+ Organizations
A joint advisory from CISA, FBI and partners says SafePay ransomware has breached at least 600 organizations since August 2024, many in critical infrastructure.
Qilin, INC Ransomware Exploit PAN-OS Flaw, Then Pivot to VMware
Unit 42 says Qilin and INC ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA, then pivot from VPN gateways to VMware vCenter and ESXi ...
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and Cummins.
China-Linked Armory Castle Exploited BeyondTrust Zero-Day
BeyondTrust patched CVE-2026-102764, a Remote Support zero-day that China-nexus group Armory Castle exploited since late August, per Mandiant and Google.
Microsoft Seizes Domains of Chinese Phishing Kits Behind 1B Messages
Microsoft, Health-ISAC and partners seized domains tied to the CoGUI, Haozi and Iron Man phishing kits and YAM Store, linked to over a billion scam ...
DOJ Charges 14 in North Korean IT Worker Laptop Farm Case
DOJ unsealed an indictment charging 14 people in a North Korean IT worker scheme that took in more than $3 million; the FBI searched 40 ...
FTC Sues Sextortion Help Operator Dmitry Belkin Over $60M Fraud
The FTC sued Dmitry Belkin and Digital Forensics Corporation, alleging a fake sextortion help scheme took in at least $60 million from blackmail victims.
CyberXero Broker Used Claude Code Agents to Steal Ukrainian Data
A Russian-speaking initial access broker, CyberXero, ran 51 Claude Code agents to compromise WordPress sites and steal over 628,000 Ukrainian records.
P7 DarkSword iOS Exploit Kit Variant Adds Crypto-Wallet Theft
Researchers disclosed P7, a DarkSword iOS exploit kit variant that steals data from 25+ crypto-wallet apps and adds remote command execution to iPhones.
CISA, FBI Say SafePay Ransomware Has Hit 600+ Organizations
October 21, 2026
A joint advisory from CISA, FBI and partners says SafePay ransomware has breached at least 600 organizations since August 2024,
Qilin, INC Ransomware Exploit PAN-OS Flaw, Then Pivot to VMware
October 21, 2026
Unit 42 says Qilin and INC ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA, then pivot from VPN gateways
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
October 20, 2026
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and
China-Linked Armory Castle Exploited BeyondTrust Zero-Day
October 16, 2026
BeyondTrust patched CVE-2026-102764, a Remote Support zero-day that China-nexus group Armory Castle exploited since late August, per Mandiant and Google.
Microsoft Seizes Domains of Chinese Phishing Kits Behind 1B Messages
October 15, 2026
Microsoft, Health-ISAC and partners seized domains tied to the CoGUI, Haozi and Iron Man phishing kits and YAM Store, linked
DOJ Charges 14 in North Korean IT Worker Laptop Farm Case
October 14, 2026
DOJ unsealed an indictment charging 14 people in a North Korean IT worker scheme that took in more than $3
FTC Sues Sextortion Help Operator Dmitry Belkin Over $60M Fraud
October 14, 2026
The FTC sued Dmitry Belkin and Digital Forensics Corporation, alleging a fake sextortion help scheme took in at least $60
CyberXero Broker Used Claude Code Agents to Steal Ukrainian Data
October 12, 2026
A Russian-speaking initial access broker, CyberXero, ran 51 Claude Code agents to compromise WordPress sites and steal over 628,000 Ukrainian
P7 DarkSword iOS Exploit Kit Variant Adds Crypto-Wallet Theft
October 12, 2026
Researchers disclosed P7, a DarkSword iOS exploit kit variant that steals data from 25+ crypto-wallet apps and adds remote command
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.